Executive brief
Version 2.0.2 of the stream-combine npm package contained malicious code designed to harvest sensitive user data. The compromised version scanned web forms for passwords, credit card numbers, and security codes, then exfiltrated this information to remote servers. Any application using this package to process or handle payment or authentication data may have exposed customer credentials and payment information.
Technical details
This is a supply-chain attack involving a malicious npm package. Version 2.0.2 of stream-combine was published with embedded code that searches the DOM for HTML form elements and extracts password fields, credit card numbers, and CVC/CVV codes. The stolen data is then exfiltrated via HTTP requests using HTML links or form action attributes embedded in the page. No authentication or user interaction is required beyond the application loading and executing the malicious package. Applications with strict Content Security Policy (CSP) headers may mitigate data exfiltration. The package was subsequently removed from the npm Registry; users should downgrade to version 2.0.1 or remove the dependency entirely.
Affected products
- npm stream-combine 2.0.2
Timeline
- 2020-09-02: disclosed
- 2020-08-31: other: GitHub security review completed